Skip to content
CVSS 7.3 · HIGH

CVE-2026-6987

A vulnerability was detected in PicoClaw up to 0.2.4. Impacted is an unknown function of the file /api/gateway/restart of the component Web Launcher Management Plane. Performing a manipulation results in command injection. It is possible to initiate the attack remotely. The project was informed of the problem early through an issue report but has not responded yet.

Ver en NVD

Análisis

This vulnerability allows for remote command injection in the PicoClaw Web Launcher Management Plane. However, PicoClaw is a niche tool specific to Sipeed hardware and is not widely used within the general web, mobile, or backend development stack.

Severidad

Puntaje: 7.3(HIGH)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
AV: NETWORK
AC: LOW
PR: NONE
UI: NONE
S: UNCHANGED
C: LOW
I: LOW
A: LOW
Tipo de falla (CWE): CWE-74CWE-77

EPSS

Probabilidad de explotación (próx. 30 días): 0.0020 (0.2%)
Percentil: 41.5%
EPSS: 2026-05-06

Afecta

sipeed:picoclaw

Descripción técnica

A vulnerability was detected in PicoClaw up to 0.2.4. Impacted is an unknown function of the file /api/gateway/restart of the component Web Launcher Management Plane. Performing a manipulation results in command injection. It is possible to initiate the attack remotely. The project was informed of the problem early through an issue report but has not responded yet.

Publicada: 25/4/2026, 17:16:33
Última modificación: 1/5/2026, 20:24:30

Referencias

InicioEventosBlogRecursosEquipo